drydocklisted

# Drydock A dry dock is where the work happens that cannot happen afloat: the boat comes out of the water on a schedule, gets specific hull work done, and goes back in able to sail. Two things make a yard trustworthy. It works from a list, one item at a time, and it never launches a boat mid-repair: at every point the vessel in the dock is one that could float. Dependency work deserves the same shape, because the usual alternative is one heroic upgrade-everything branch that dies unmerged. **The tree floats after every commit.** Every commit this skill leaves behind is a tree where install, build and gate all pass. There is no "upgrade first, stabilize later" phase, ever: a raise either proves out or gets reverted and held. ## 1. The yard list Read the manifests and lockfiles for every ecosystem the repository actually carries - npm, pip, cargo, composer, gems, go modules, whatever is present - and build the list: each dependency with its installed version, its latest, the distance between the two, and any security advisory the ecosystem's own audit reports. Present the list priced - so many advisories, so many majors, so many minors and patches, per manifest - and ask the scope: everything, advisories only, or named dependencies. A user who already named the scope in their request skips the question. Order of work, fixed: **advisories first**, then raises that unblock other raises, then majors one by one, then the minor-and-patch remainder. Not alphabetical, not larges